SB2026012818 - Multiple vulnerabilities in IBM DB2 Data Management Console
Published: January 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 41 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-38809)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when parsing ETags from "If-Match" or "If-None-Match" request headers. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.
2) Incorrect Regular Expression (CVE-ID: CVE-2022-25883)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application via the new Range function and perform regular expression denial of service (ReDos) attack.
3) Security features bypass (CVE-ID: CVE-2025-22233)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to String.toLowerCase() has some Locale dependent exceptions when handling case insensitive patterns in DataBinder. A remote attacker can bypass implemented security restrictions by passing specially crafted data to the application.
Note, the vulnerability exists due to incomplete fix for #VU98795 (CVE-2024-38820).
4) Security features bypass (CVE-ID: CVE-2024-38820)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to String.toLowerCase() has some Locale dependent exceptions when handling case insensitive patterns in DataBinder. A remote attacker can bypass implemented security restrictions by passing specially crafted data to the application.
5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2022-25881)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to regular expression denial of service that occurs when the server reads the cache policy from the request using this library. A remote unauthenticated attacker can send malicious request header values to the server and perform a denial of service attack.
6) Protection Mechanism Failure (CVE-ID: CVE-2025-41249)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. A remote attacker can gain access to sensitive information.
7) Protection Mechanism Failure (CVE-ID: CVE-2025-41248)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the annotation detection mechanism does not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. A remote attacker can gain access to sensitive information.
8) Security features bypass (CVE-ID: CVE-2022-22968)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to patterns for disallowedFields on a DataBinder are case sensitive, which means a field is not effectively protected unless it is listed
with both upper and lower case for the first character of the field,
including upper and lower case for the first character of all nested
fields within the property path. A remote attacker can bypass implemented security restrictions by passing case sensitive data to the application.
9) Improper verification of cryptographic signature (CVE-ID: CVE-2024-48948)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect validation of valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. Such behavior leads to valid signatures being rejected.
10) Input validation error (CVE-ID: CVE-2025-22870)
The vulnerability allows a remote attacker to alter application's behavior.
The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to
"[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially gain access to sensitive information or functionality.
11) Resource exhaustion (CVE-ID: CVE-2025-29907)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the "addImage" method. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
12) Incorrect Regular Expression (CVE-ID: CVE-2022-25858)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
13) Incorrect Regular Expression (CVE-ID: CVE-2024-4067)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
14) Resource exhaustion (CVE-ID: CVE-2025-30204)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the parse.ParseUnverified function when parsing authorization header. A remote attacker can send a specially crafted HTTP response to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.
15) Prototype pollution (CVE-ID: CVE-2023-26136)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
16) Uncontrolled Memory Allocation (CVE-ID: CVE-2024-4068)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. A remote attacker can send "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
17) Inefficient regular expression complexity (CVE-ID: CVE-2025-5889)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote user can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
18) Infinite loop (CVE-ID: CVE-2024-30172)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the Ed25519 verification code. A remote attacker can pass a specially signature and public key to the application, consume all available system resources and cause denial of service conditions.
19) Resource exhaustion (CVE-ID: CVE-2024-45338)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in several Parse functions. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
20) Input validation error (CVE-ID: CVE-2024-38828)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input passed via Spring MVC controller method with @RequestBody byte[] parameter. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
21) Infinite loop (CVE-ID: CVE-2025-57810)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the addImage method. A remote attacker can consume all available system resources and cause denial of service conditions.
22) Resource exhaustion (CVE-ID: CVE-2025-6493)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the functionality of the file mode/markdown/markdown.js of the component Markdown Mode. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
23) Resource exhaustion (CVE-ID: CVE-2022-2596)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
24) Uncontrolled Recursion (CVE-ID: CVE-2025-48924)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. A remote attacker can trigger uncontrolled recursion and perform a denial of service (DoS) attack.
25) Input validation error (CVE-ID: CVE-2025-41234)
The vulnerability allows a remote attacker to perform a reflected file download attack.
The vulnerability exists due to application sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. A remote attacker can trick the victim into downloading arbitrary files from an attacker controlled location.
26) Cross-site scripting (CVE-ID: CVE-2025-26791)
The disclosed vulnerability allows a remote attacker to perform mutation cross-site scripting (XSS) attacks.
The vulnerability exists due to DOMPurify has an incorrect template literal regular expression. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
27) Incorrect Regular Expression (CVE-ID: CVE-2022-37599)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input passed via the resourcePath variable to interpolateName() function in interpolateName.js. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.28) Prototype pollution (CVE-ID: CVE-2022-37601)
The disclosed vulnerability allows a remote attacker to perform prototype pollution attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the parseQuery() function in parseQuery.js. A remote attacker can inject and execute arbitrary JavaScript code.
29) Inadequate encryption strength (CVE-ID: CVE-2023-48795)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.
The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.
30) Prototype pollution (CVE-ID: CVE-2025-25977)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can execute arbitrary code via the Constructor of the class StyleElement.
31) Insufficient technical documentation (CVE-ID: CVE-2024-51744)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due due to unclear documentation of the error behavior in "ParseWithClaims". A remote attacker can trick the victim into accepting invalid tokens, which can lead to information disclosure.
32) Open redirect (CVE-ID: CVE-2022-33987)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to requested URLs are not verified and allow open redirection to a local UNIX socket. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
33) Resource exhaustion (CVE-ID: CVE-2025-22869)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the ssh package when handling clients that complete the key exchange slowly, or not at all. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
34) Inefficient regular expression complexity (CVE-ID: CVE-2025-27789)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
35) Input validation error (CVE-ID: CVE-2024-48949)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input within the verify() function in lib/elliptic/eddsa/index.js. A remote attacker can send specially crafted input to the application and bypass implemented security restrictions.
36) Observable discrepancy (CVE-ID: CVE-2024-30171)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a possible timing based leakage in RSA based handshakes. A remote attacker can gain access to sensitive information.
37) Input validation error (CVE-ID: CVE-2022-38900)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
38) Use of insufficiently random values (CVE-ID: CVE-2025-7783)
The vulnerability allows a remote attacker to perform parameter injection attacks.
The vulnerability exists due to software uses a weak Math.random() method to generated random values for multipart form-encoded data. A remote attacker can observe values produced by Math.random in the target application and predict the random number used to generate form-data's boundary value and inject arbitrary parameters into requests.
39) Path traversal (CVE-ID: CVE-2025-48050)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to scripts/server.js does not ensure that a pathname is located under the current working directory. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
40) Embedded malicious code (backdoor) (CVE-ID: CVE-2025-54313)
The vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to presence of embedded malicious code in the application caused by maintainer account compromise on July 18. A remote attacker can compromise the affected system.
Reportedly the issue affects Microsoft Windows installations only.
41) Path traversal (CVE-ID: CVE-2024-38816)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Specifically, an application is vulnerable when both of the following are true:
- the web application uses
RouterFunctions</code> to serve static resources</li><li>resource handling is explicitly configured with a <code>FileSystemResourcelocation
Remediation
Install update from vendor's website.